POP3 is usually used for mail client to mail server communications. The normal operation of POP3 is as follows:
- Open the email client and enter the username and password for login access.
- Use POP as a display filter to list all the POP packets. It should be noted that this display filter will only list packets that use TCP port 110. If TLS is used, the filter will not list the POP packets. We may need to use tcp.port == 995 to list the POP3 packets over TLS.
- Check the authentication has been passed correctly. In the following screenshot, you can see a session opened with a username that starts with doronn@ (all IDs were deleted) and a password that starts with u6F.
- To see the TCP stream shown in the following screenshot, ...